Skip to content
You can now search across every topic, entity and event.What's new
Cybersecurity: Threats and Defences
5SEP

UAE council says it stopped three-sector attacks

2 min read
12:09UTC

The UAE Cyber Security Council said on 10 August that national teams had detected and contained coordinated attacks on aviation, energy and education before the attackers reached their objectives. It named no actor, victim or technology.

TechnologyDeveloping
Key takeaway

A second monthly UAE announcement of contained attacks names nothing anyone outside the Council can check.

The UAE Cyber Security Council, the United Arab Emirates' national cyber authority, said on 10 August that national Teams had detected and contained coordinated attacks on aviation, energy and education before the attackers reached their objectives or affected service continuity 1. Its description covers attempted breaches of digital infrastructure, attempts on operational accounts and data, targeted phishing, and attempts to use staff as a way in.

The statement omits everything a reader could check. No actor is named, no victim organisation, no product, no technique beyond the categories above and no date for the attacks themselves. Nobody outside the Council can verify any of it, and nobody outside the affected organisations can act on it, because there is no indicator to search a network for.

The Council has now made two such announcements in two months, after the financial-sector intrusion attempts it reported detecting on 3 July. Two in two months reads as a communications policy rather than coincidence, and the policy has a rationale: a national authority that only appears in public after a successful attack teaches its own economy that it exists to announce failures.

Institutions elsewhere have taken the opposite decision with a similar amount of substance. The G7 Cyber Expert Group closed its 2026 cross-border coordination exercise on or before 31 July without publishing a scenario, a participant list or findings . One body says little and names it an announcement; the other says nothing at all. Neither leaves an operator in the covered sectors anything to do differently on Monday.

Deep Analysis

In plain English

The UAE's Cyber Security Council said its national teams detected and stopped a coordinated attack targeting aviation, energy and education organisations before the attackers reached their goals. It described phishing and attempts to trick staff into giving attackers a way in. The Council did not name who was behind the attacks, which specific organisations were targeted, or what technology was involved. This was its second such monthly announcement.

Deep Analysis
Root Causes

The UAE Cyber Security Council named no actor, victim or technology in its 10 August statement, which means the claim that attacks were detected and contained cannot be independently verified against a technical indicator, only taken as the Council's own account.

This is the Council's second monthly disclosure of this kind, following a financial-sector one on 3 July, suggesting a deliberate cadence of public reassurance statements rather than incident-by-incident disclosure as each event occurs.

First Reported In

Update #13 · Four privileged platforms under live attack

Emirates News Agency· 5 Sept 2026
Read original
Different Perspectives
ENISA
ENISA
ENISA published an SME cyber-resilience maturity model on 6 August and updated the Cyber Resilience Act reporting-platform FAQ on 31 August. The agency supplies common implementation tools for smaller operators, but it cannot fine organisations that do not use them.
UAE Cyber Security Council
UAE Cyber Security Council
On 10 August, the UAE Cyber Security Council said national teams contained attacks on aviation, energy and education before objectives were reached. Its second monthly statement, after a 3 July financial-sector disclosure, makes public reporting of stopped attacks part of its operating posture.
South African authorities
South African authorities
INTERPOL said on 25 August that South African authorities made 39 arrests, seized US$2.67 million and blocked 257 accounts during Operation Jackal IV. Their share of the 23-country operation shows the material enforcement burden in a cross-border fraud case.
Europol
Europol
On 2 September, Europol announced the sinkholing of Sality after a 31 August operation involving US, Bulgarian, Hungarian and Romanian authorities. Its more than 11 million linked IP addresses measure infrastructure contact, not confirmed victims, and show why technical partners joined the action.
CISA
CISA
From 3 August to 2 September, CISA recorded three-day deadlines for 24 of 37 KEV additions, compared with 34 of 39 from 10 June to 29 July. The falling share changes the urgency signal that US federal agencies and private-sector tooling draw from the catalogue.
Beacon
Beacon
On 3 September, Beacon said its final report found that an intruder likely exported its customer database during roughly one hour and 27 minutes on 27 July. Charities using the CRM now have a named exposure route, a compromised AWS access key in public build artefacts.